AI Use Policy Guide for Credit Unions

The short answer

A credit union’s AI use policy should tell staff which AI tools are approved, what member information may never be entered into AI tools, which uses need approval first, and how any AI role in lending or account decisions is reviewed and explained. It should sit inside the information security program the board approves under NCUA Part 748, so AI is governed like every other system that touches member data.

What the policy must cover

Policy section	What it should say
Scope	Applies to all employees, volunteers, and contractors, and to every AI tool, including AI features added to your core, loan origination, and contact center systems.
Approved tools	Only tools on the approved register may be used for credit union work, and only approved tools may receive member information.
Member information	Nonpublic personal information may never be entered into consumer AI tools or any tool that is not approved for member data.
Credit and account decisions	AI may support lending and account decisions only through an approved process that supports specific adverse action reasons and fair lending testing.
Member-facing AI	Chatbots and other member-facing tools are disclosed as AI, offer a path to a person, and route disputes and complaints correctly.
Marketing	AI-written marketing is reviewed for accuracy, required disclosures, and fair lending concerns before it is published.
Oversight	A named owner keeps the AI register, approves new uses, and reports to the board at least annually.
Training and incidents	Staff complete AI training before using approved tools and report suspected misuse or data exposure immediately.

Approved, restricted, and prohibited uses

Approved

Drafting internal documents with no member information
Summarizing public laws, regulations, and guidance
Brainstorming and editing general marketing ideas

Requires approval

Any tool that receives member information
AI in fraud, AML, or credit decisions
Member-facing chatbots
Publishing AI-written marketing

Prohibited

Entering member information into consumer AI tools
AI making credit decisions outside the approved process
Using AI to infer protected characteristics

Sample policy language

Section 1 · Approved tools

Employees may use only AI tools listed on the credit union’s approved register. Member information may be entered only into tools approved for that purpose.

Section 2 · Credit and account decisions

AI tools may assist with credit and account decisions only through processes approved by the AI governance committee that support specific adverse action reasons and fair lending review.

Section 3 · Member-facing AI

Any AI tool that interacts directly with members must identify itself as AI and provide a way to reach a staff member.

Frequently asked questions

Should a credit union ban ChatGPT and similar tools?

An outright ban usually pushes use underground. A better approach is to approve a business version of a tool with appropriate data protections, prohibit member information in consumer versions, and train staff on the difference.

Who should approve the AI use policy?

Management should develop it and the board should approve it, either directly or as part of the information security program the board approves under NCUA Part 748.

More Guides for Credit Unions and Lenders

Sources

How this guide is built

Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.

Cite this guide

Cogent Assurance. (2026). AI Use Policy Guide for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/ai-use-policy-guide-credit-unions

Report an issue

See something out of date or incorrect? Tell us and we’ll review it.

Report an issue with this guide

This guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.